+27 11 343 2000 info@prism.co.za

The PrismToken

Overview

  • PrismToken is a new concept in the STS environment. It is not a new category of product, but rather is part of a Vending
    System. Specifically, it is the part that can issue STS tokens and manage STS vending keys.
  • PrismToken combines an STS6 Security Module (SM), Vending Key store, and the STS “POS Application Process” into a single product that readily integrates into a Vending System. The PrismToken has a web-based User Interface to manage STS vending keys and a Thrift network service that the Vending System calls to issue STS tokens.
  • To issue an STS token for a meter, third-party software integration with PrismToken only needs to know the meter’s
    configuration (SGC, KRN, TI, EA, TCT) to issue an STS token. PrismToken handles all other details of the STS environment.
  • PrismToken provides a low-effort quick-turnaround approach to bring the benefits of STS6 into a vending system.
  • PrismToken is not a full vending system; instead, it is the component of a vending system that issues STS tokens:
    • PrismToken focuses on implementing just the STS standards.
    • In particular, PrismToken does not provide any of the following: point of sale, database of meters, customer accounts or debt collection, tariff support, business rules (other than the STS POS Application Process rules), a transaction database, reporting, reconciliation and settlement.
      Note: These ‘non’ STS specified features may be implemented in a vending system as per the users business and operational requirements, and are outside the scope of STS specifications.

Value proposition:

The PrismToken is a Commercial-Off-The-Shelf (COTS) product that can be used by Vending Systems that need to support STS. It provides turnkey STS token issue that is fully STS compliant and is easily integrated into a Vending System using a simple high-level API. PrismToken keeps up-to-date as the STS standards evolve.

Benefits

The PrismToken provides the following benefits:

  • STSA Certified 1 token creation, complying with: [IEC 62055-41 Ed 3], [STS600-4-2], [STS531-1-0-02], [STS531-1-0-04],
    [STS202-1], [STS202-2], [STS202-3], [STS202-5], [STS202-6], and [STS402-1].
  • Compatible with and secured by the Prism TSM250 and TSM500i STS certified security modules.
  • Fast and easy integration via a Thrift API.
  • Supports [STS600-4-2] key management including integration with the new Key Management Centre.
  • Control – Manage who can vend supply Group Code’s and enable key expiry. Risk Control features like vend value limits and passive key revocation are provided by Prism SM extended metadata that controls key use (see [PR-D2-0970]). The metadata is configured at the KMC (see [PR-D2-1001]), allowing the Utility to manage risk and protect revenue irrespective of who is operating the SM.
  • Base Date and TID Rollover support [STS402-1].
  • Supports next-generation security including HMAC DKGA and MISTY1 EA [STS202-3].
  • Service agreement covers product warranty, support, and upgrades.

Core Functionality

The core functionality of the PrismToken – which developers would otherwise need to implement in their Vending System – includes the following:

  • Communicates with the SM using the drivers and low-level API (STS600-8).
    • SM supports DKGA=04 and EA=11 per [STS202-3].
  • Implements [STS600-4-2] key management processes using the SM, so there is no need to handle STS key management operations in the Vending System:
    • Provides a User Interface to key management features.
    • Generates VKLOADREQ that may be e-mailed to the KMC.
    • Parses an STS6 Enhanced Key Load File received from the KMC, loads the Vending Keys contained therein and maintains a store of Vending Key metadata and corresponding SM key register.
    • Provides Key Expiry warnings required by [STS 202-6].
  • Thrift API to issue Credit (class=0), MeterTest (class=1), Management (class=2), and Key Change tokens.
    • Communication is over TCP/IPv4 with Transport Layer Security (TLS).
    • Implements TokenID conversion for the Vending Key’s Base Date (BDT) per [IEC 62055-41] and [STS402-1].
    • Maintains a store of TokenIDs issued per meter to prevent TokenID duplication (POS Application Process equivalent of Token Cancellation).
    • Provides Transfer Amount encoding for unit and currency tokens per [IEC 62055-41], [STS202-1], and [STS202-5]. Currency encoding is validated against the STSA VSM.
    • Supports 2-digit and 4-digit Manufacturer Code in meter PAN per [IEC 62055-41] and [STS202-2].
    • Supports Rollover Key Change tokens for BaseDate change (and associated TID rollover).
    • Supports 2-token (EA=07), 3-token (EA=07), and 4-token (EA=11) key change sets per [IEC 62055-41] and [STS202-3].
  • The API is specified using the Thrift Interface Definition Language (IDL) which automatically generates the client’s software.
  • Supports Prism instruction certificates (to convey SM manufacturer instructions to the SM) (see [PR- D2-0970] and [PR-
    D2-0828]).
  • Provides a User Interface to miscellaneous SM configuration options and diagnostics.
  • Handles the token generation portion of an STS transaction in a manner compatible with [SANS 1524- 6-10].
  • STSA certified Point Of Sale (Entity Type A), tested against [STS531-1-0-02] and [STS531-1-0-04].
  • {Future;Unplanned} Support for [STS101-2] virtual token carrier for DLSM/COSEM integration.

Also, the PrismToken maintains all this functionality in the face of an ongoing evolution of the IEC specification, STSA standards, Security Module, and Key Management Centre.

What The Prismtoken Doesn’t Do:

  • Provide for meter registration, MSNO1 vending, or a meter configuration database.
  • Implement [SANS 1524-6-10] (XMLVend) business rules (such a Grace Purchases, or resolving discrepancies between a
    meter’s magstripe card and the meter configuration database).
  • Conversion of currency amounts to STS transfer units, using a Tariff mechanism.
  • A database (or log) of vending transactions or tokens issued.
  • Any form of “service point” or “point of connection” management.
  • Any form of customer management, accounting, or debt collection.

The Vending System must provide this functionality.

Relationship to SM API

  • The Security Module (SM) is the component of an STS system that secures the Vending Keys (VKs) and allows them to be used to construct STS tokens. While the SM only constructs well-formed tokens (per IEC 62055- 41), it has limited ability to enforce STS operational rules or ensure that the token is fit for purpose.
  • Using an SM is necessary for building an STS vending system that complies with the IEC standard and STSA rules,
    but is not sufficient.
  • The PrismToken provides high-level capabilities that result in a fully compliant subsystem for issuing STS tokens; these capabilities include:
    • Management of vending keys and association with Supply Group Codes (SGCs).
    • TokenId management to prevent the issue of duplicate tokens to a meter, and to restrict the issue of Special Reserved tokens.
    • Conversion of token fields (such as Transfer Amount and TokenId) to and from STS representation, with correct rounding.
    • To issue an STS token for a meter, third-party software integrating with the PrismToken need only know the meter’s configuration; PrismToken handles all other details of the STS environment.

XMLVend

  • XMLVend is an XML-based protocol for Point-Of-Sale (POS) devices to communicate with an STS vending server. XMLVend is standardised in [SANS 1524-6-10].
  • XMLVend assumes that the server integrates with POS and technical support systems, and supports functions such as payment and customer care; all of which are out of scope for the PrismToken. The token issue is a subset of the back-office functionality provided by a vending server, and as such the token issuing subsystem (PrismToken) cannot accept XMLVend requests.
  • It would be typical for the PrismToken to be a component of a vending system that supports XMLVend. The PrismToken is designed to handle the issue of STS tokens within certain XMLVend transactions, in the manner prescribed by [SANS 1524-6-10] and other Eskom documents.
  • Meter Serial Number Only (MSNO) vending looks up the meter’s configuration in a database given on the PAN or DRN (serial number).

3rd Floor, President Place, Cnr Jan Smuts Ave & Bolton Road, Rosebank, Johannesburg, SA

+27 11 343 2000

+27 11 442 5908

info@prism.co.za

3rd Floor, President Place, Cnr Jan Smuts Ave & Bolton Road, Rosebank, Johannesburg, SA

+27 11 343 2000

info@prism.co.za

+27 11 442 5908